Skip to content

docs: Pass Docker credentials in a safer way

Florian Forster requested to merge fforster/docker-auth into master

What does this MR do and why?

docs: Pass Docker credentials in a safer way.

Passing the password/token on the command line is insecure and can easily leak, e.g. via the ps command line tool. The here-string syntax <<<$var avoids this problem.

While there improved language that could be misread as CI_REGISTRY_PASSWORD being a short-lived token. According to https://docs.gitlab.com/ee/ci/jobs/ci_job_token.html#gitlab-cicd-job-token-security the token is long-lifed and needs to be kept secret.

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

Before After

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

Screenshot_2024-01-18_at_14.28.16

Merge request reports